execute_code 运行时

execute_code 多运行时

一个工具、多种运行时；默认 Bun；按需扩展 Python / Deno。

背景

execute_code 在受控子进程中运行短脚本。LLM 必须知道写什么语言、选哪个运行时——否则把 Python 发给 Node 会失败。

与 terminal 的分工

	execute_code	terminal
Execution	No shell, fixed runtime	Default shell=false (argv); shell=true for pipes/redirection
Best for	Short scripts, data processing, logic checks	System commands, git, long tasks; pipes need shell=true
Output	50KB cap, configurable timeout	Same limits
Security	No shell injection; not a FS sandbox	Catastrophic command hard deny + workdir path policy; still ≠ OS sandbox

Python 批处理请用 execute_code(runtime="python")，不要在 terminal 里 python3 -c "..."。

API

execute_code({
  code: string,
  runtime?: "bun" | "nodejs" | "python" | "deno",  // default bun
  timeout?: number,       // seconds, default 300, max 600
})

可用运行时

runtime	语言	状态
bun	TypeScript / JavaScript	✅ 默认
nodejs	TypeScript / JavaScript	✅ 已实现
python	Python	🔲 预留（Issue #40）
deno	TypeScript	🔲 预留（Issue #40）

配置（预留）

execute_code:
  default_runtime: bun
  runtimes:
    nodejs:
      enabled: true
    python:
      enabled: true
      command: python3
    deno:
      enabled: false

禁用的运行时会返回明确错误，并列出可用运行时。

安全

• Always shell: false (see security.md)
• 超时与输出大小限制与当前实现一致
• 不要根据代码内容自动猜测运行时
• JS runtimes can still import node:fs—terminal command hard denies do not apply inside code_execute

Credential Injection

code_execute (and terminal_run) accept optional secrets[]: Vault item refs decrypted for that subprocess only and merged into child env (not Habitat process.env). Values never appear in LLM tool results. Prefer argv / process.env.NAME inside the snippet; no vault CLI inside runtimes.

File-path credential mounts (Issue #40 style) are not implemented; use secrets[] for CLI/runtime needs.